Freaks Macintosh Archive/Freaks Macintosh Archive.bin/Freaks Macintosh Archives/Textfiles/coloredbooks/GreenBook.sit.hqx/Green Book

Text File | 1997-11-17 | 57KB | 1,341 lines

 A Guide to Understanding Data Remanence in Automated Information
Systems




 A Guide to Understanding Data Remanence in Automated Information
Systems



NCSC-TG-025


Library No. 5-236,082


Version-2
FOREWORD



The National Computer Security Center is issuing A Guide to Understanding
Data Remanence in Automated Information Systems as part of the
"Rainbow Series" of documents our Technical Guidelines
Program produces. In the Rainbow Series, we discuss in detail
the features of the Department of Defense Trusted Computer System
Evaluation Criteria (DoD 5200.28-STD) and provide guidance for
meeting each requirement.  The National Computer Security Center,
through its Trusted Product Evaluation Program, evaluates the
security features of commercially-produced computer systems.
Together, these programs ensure that organizations are capable
of protecting their important data with trusted computer systems.
 While data remanence is not a directly evaluated criterion of
trusted computing systems, it is an issue critical to the safeguarding
of information used by trusted computing systems.


A Guide to Understanding Data Remanence in Automated Information
Systems is intended for use by personnel responsible for the secure
handling of sensitive or classified automated information system
memory and secondary storage media.  It is important that they
be aware of the retentive properties of such media, the known
risks in attempting to erase and release it, and the approved
security procedures that will help prevent disclosure of sensitive
or classified information. This version supersedes CSC-STD-005-85,
Department of Defense Magnetic Remanence Security Guideline, dated
15 November 1985.


As the Director, National Computer Security Center, l invite your
suggestions for revising this document. We plan to review this
document as the need arises.

 • Patrick R.   Gallagher, JR
   September 1991
 • Director National Computer Security Center





ACKNOWLEDGMENTS



The National Computer Security Center extends recognition to Captain
James K. Goldston, United States Air Force, for providing engineering
support and as primary author and preparer of this guideline.
We thank the many people involved in preparing this document.
 Their careful review and input were invaluable.  The National
Computer Security Center extends recognition to Dr. Blaine W.
Burnham and David N. Kreft, without whom this revision could not
have taken place.  Other reviewers that provided much needed input
are Carole S. Jordan, Lawrence M. Sudduth, and Kim Johnson-Braun
and George L. Cipra.
INTRODUCTION



Data remanence is the residual physical representation of data
that has been in some way erased.  After storage media is erased
there may be some physical characteristics that allow data to
be reconstructed.  This document discusses the role data remanence
plays when storage media is erased for the purposes of reuse or
release.


Various documents have been published that detail procedures for
clearing, purging, declassifying, or destroying automated information
system (AIS) storage media. [1,2,4, 5, 6, 8,9,13 and 16] The Department
of Defense (DoD) published DoD Directive 5200.28, Security Requirements
for Automated Information Systems, [17] and its corresponding
security manual DoD 5200.28-M, Automated Data Processing Security
Manual, [1] in 1972 and 1973, respectively.  These two documents
were amended in 1979, in response to the Defense Science Board
Task Force recommendation to establish uniform DoD policy for
computer security requirements, controls, and measures.  The directive
was again revised in March 1988, and efforts are underway to revise
the manual.


DoD 5200.28-M addresses DoD requirements for the secure handling
and disposal of AlS memory and secondary storage media.  While
the Department of Defense requires the use of DoD Directive 5200.28
and DoD 5200.28-M by DoD components, the heads of DoD components
may augment these requirements to meet their needs by prescribing
more detailed guidelines and instructions provided they are consistent
with these policies.  DoD contractors and subcontractors who participate
in the Defense Industrial Security Program (DISP) are required
to comply with DoD 5220.22-M, Industrial Security Manual
for Safeguarding Classified Information. [8]   The Defense Investigative
Service is responsible for the promulgation of the policy reflected
in DoD 5220.22-M.   Unlike these policy documents, A Guide To
Understanding Data Remanence In Automated Information Systems
does not provide requirements.


Sometime during the life cycle of an AIS, its primary and secondary
storage may need to be reused, declassified, destroyed, or released.
 It is important that security officers, computer operators, and
other users or guardians of AS resources be informed of the risks
involving the reuse, declassification, destruction, and release
of AlS storage media.  They also should be knowledgeable of the
risks inherent in changing the sensitivity level of AS storage
media or of moving media from an installation with a specific
security posture tone that is less secure. They should use proper
procedures to prevent a possible disclosure of sensitive information
contained on such media.  ("Sensitive" in this document
refers to classified and sensitive but unclassified information.)
 The procedures and guidelines in this document are based on research,
investigation, current policy, and standard practice.


This guideline is divided as follows:  Section 2 provides information
on using this guideline and introduces DoD terminology.  Section
3 discusses the use of degaussers and references the Degausser
Products List (DPL), a listing of DoD evaluated degaussers. Section
4, "Risk Considerations," has information similar to
that found in version 1 of this document, except for the modification
of Section 4.2, "Effects of Heat and Age," and the addition
of information on overwriting and degaussing.  Section 5 addresses
DoD endorsed erasure standards.  Recently developed storage technologies
and disk exercisers are discussed in Section 6.  Section 7 addresses
areas needing further investigation and provides references to
additional information on the science of magnetics, as it pertains
to magnetic remanence.
1.1 PURPOSE



The purpose of this publication is to provide information to personnel
responsible for the secure handling of sensitive AlS memory and
secondary storage media.  (However, this guidance applies to any
electronic or magnetic storage media, e.g., instrumentation tape.)
 This guideline provides information relating to the clearing,
purging, declassification, destruction, and release of most AlS
storage media.  While data remanence is not a directly evaluated
criterion of trusted computing systems, it is an issue critical
to the safeguarding of information used by trusted computing systems
and, as such, is addressed in this National Computer Security
Center (NCSC) guideline. The NCSC publishes this document because
the community using trusted computing systems has expressed the
desire for this information.  Additionally, readers should note
that this is a guideline only and they should not use it in lieu
of policy.
1.2 HISTORY



As early as 1960 the problem caused by the retentive properties
of AIS storage media (i.e., data remanence) was recognized.  It
was known that without the application of data removal procedures,
inadvertent disclosure of sensitive information was possible should
the storage media be released into an uncontrolled environment.
 Degaussing, overwriting, data encryption, and media destruction
are some of the methods that have been employed to safeguard against
disclosure of sensitive information. Over a period of time, certain
practices have been accepted for the clearing and purging of AIS
storage media.


A series of research studies were contracted by the DoD to the
Illinois Institute of Technology, Research Institute and completed
in 1981 and 1982.  They have confirmed the validity of the degaussing
practices as applied to magnetic tape media [19] Additional research
conducted at the Carnegie-Mellon University using communication
theory and magnetic modeling experiments designed to detect digital
information from erased disks has provided test data on the erasability
of magnetic disks. [11, 21, and 22] This work, along with DoD
research that has not yet been released, provides the basis for
the disk degaussing standard.  More studies are planned or underway
to ensure the adequacy of DoD degaussing standards.


On 2 January 1981, the Director of the National Security Agency
assumed responsibility for computer security within the Department
of Defense. As a result, the Department of Defense Computer Security
Center (DoDCSC), officially chartered by DoD Directive 5215.1,
was established at the National Security Agency. (3] The DoDCSC
Division of Standards (now Division of Standards, Criteria, and
Guidelines) was subsequently formed and tasked to support a broad
range of computer security related subjects. The DoDCSC became
the NCSC in 1985, as amended in National Security Decision Directive
145. [15] As part of its mission to provide information useful
for the secure operation of AISs, the NCSC published the Department
of Defense Magnetic Remanence Security Guideline, which is version
1 of this guideline.
2. GENERAL INFORMATION



An AIS and its storage media should be safeguarded in the manner
prescribed for the highest classification of information ever
processed by the AIS. That is, until the AIS and its associated
storage media are subjected to an approved purging procedure and
administratively declassified.  There should be continuous assurance
that sensitive information is protected and not allowed to be
placed in a circumstance wherein a possible compromise can occur.
 There are two primary levels of threat that the protector of
information must guard against: keyboard attack (information scavenging
through system software capabilities) and laboratory attack information
scavenging through laboratory means).   Procedures should be implemented
to address these threats before the AlS is procured, and the procedures
should be continued throughout the life cycle of the AS.
2.1 USE OF THIS GUIDELINE



Designated Approving Authorities and Information System Security
Officers (ISSOs) may refer to this guideline when selecting or
evaluating specific methods to clear, purge, declassify, or destroy
AIS storage media.  DoD components may include the information
provided in this guideline in their security training and awareness
program; however, they should not use this guideline in lieu of
existing policies.


Guidelines in this document have two degrees of emphasis.  Those
that are most important to the secure handling of AIS storage
media have such wording as "the 1550 should . . . .,,  Guidance
of lesser criticality has such wording as "it is good practice"
or "it may be."  Thus, the word "may" denotes
less emphasis or concern than the word "should."
2.2 IMPORTANT DEFINITIONS



This section provides definitions and their amplification critical
to understanding the issues in remanence. A comprehensive glossary
follows Section 7.


Clearing: The removal of sensitive data from an AIS at the end
of a period of processing, including from AlS storage devices
and other peripheral devices with storage capacity, in such a
way that there is assurance, proportional to the sensitivity of
the data, that the data may not be reconstructed using normal
system apabilities, i.e., through the keyboard.  (This may include
use of advanced diagnostic utilities.) An AIS need not be disconnected
from any external network before a clear. [1, draft version]


Clearing can be used when the secured physical environment (where
the media was used) is maintained. In other words, the media is
reused within the same AIS and environment previously used.


In an operational computer, clearing can usually be accomplished
by an overwrite of unassigned system storage space, provided the
system can be trusted to provide separation of the storage space
and unauthorized users.  For example, a single overwrite of a
file or all system storage, if the circumstance warrants such
an action, is adequate to ensure that previous information cannot
be reconstructed through a keyboard attack.  Note: Simply removing
pointers to a file, which can occur when a file is simply deleted
in some systems, will not generally render the previous information
unrecoverable through normal system capabilities (i.e., diagnostic
routines).


Purging:  The removal of sensitive data from an AlS at the end
of a period of processing, including from AlS storage devices
and other peripheral devices with storage capacity, in such a
way that there is assurance, proportional to the sensitivity of
the data, that the data may not be reconstructed through open-ended
laboratory techniques.  An AlS must be disconnected from any external
network before a purge. [17]


Purging must be used when the secured physical environment (where
the media was used) will not be maintained.  In other words, media
scheduled to be released from a secure facility to a non-cleared
maintenance facility or similar non-secure environment must be
purged.


Note: The purging definition allows a hierarchy of data eradication
procedures, although current standards do not take advantage of
this.  That is, removing data with "assurance, proportional
to the sensitivity of the data, that the data may not be reconstructed"
implies that standards can be developed to be applied hierarchically.


For example, a standard could be developed that allowed a security
officer to degauss CONFIDENTIAL tapes by 80 db, SECRET tapes by
90 db, etc.  Practice has shown, however, that this is not a feasible
approach. Authorized clearing and purging procedures are detailed
in DoD 5200.28-M and sometimes further amplified in DoD component
regulations.


1 Declassification:  A procedure and an administrative action
to remove the security classification of the subject media.
The procedural aspect of declassification is the actual purging
of the media and removal of any labels denoting classification,
possibly replacing them with labels denoting that the storage
media is unclassified. The administrative aspect is realized through
the submission to the appropriate authority of a decision memorandum
to declassify the storage media.


Whether declassifying or downgrading the storage media, the memorandum
should include the following:

 • a. A description of the media (type, manufacturer, model,
and serial number).
 • b. The media's classification and requested reclassification
as a result of this action.
 • c. A description of the purging procedures to include the
make, model number, and serial number of the degausser used and
the date of the last degausser test if degaussing is done; or
the accreditation statement of the software if overwriting is
done; or the description of and authorization to use the purging
procedure if the purging procedure is different from the preceding
procedures.
 • d. The names of the people executing the procedures and verifying
the results.
 • e. The reason for the downgrade, declassification, or release.
 • f. The concurrence of the data owner that the action is nece,ssary.
 • g. The intended recipient or destination of the AIS and storage
media.







Coercivlty measured in oersteds (Oe), is a property of magnetic
material used as a measure of the amount of applied magnetic field
(of opposite polarity) required to reduce magnetic induction to
zero from its remanent state, i.e., taking the media from a recorded
state to an unrecorded state. Coercivity values are available
from the manufacturer or vendor.


Type I Tape: Magnetic tape with coercivity not exceeding 350 Oe
(also known as low-energy tape), for example, iron oxide coated
tape.  Note: The maximum coercivity level has changed from 325
Oe to 350 Oe.


Magnetic disks, i.e., oxide particles on a metal substrate, also
have varying coercivity levels.  Research has shown, however,
that the physical remanence properties of disks are easier to
address.  Because of this, disks are treated as Type I media and
are discussed in more detail later.


Type II Tape: Magnetic tape with coercivity ranging from 351 to
750 Oe (also known as high-energy tape), for example, chromium
dioxide coated tape.


The determination of the Types l and II definitions was largely
a result of the tape manufacturing industry. Low-energy tapes
were developed first, and they have coercivities around 300 Oe
+ 10%.  The next generation tape was high-energy tape, whose coercivity
is around 650 Oe + 10%.  There have been no naturally occurring
plateaus for which to define a Type Ill tape. As a practical matter,
there are no degaussers that can yet meet the requirements of
National Security Agency/Central Security Service (NSA/CSS) Specification
Ll 4-4-A for tapes above Type Il. [13]


Type 111 Tape:  Magnetic tape with coercivity above 750 Oe, for
example, cobalt-modified iron oxide coated tape and metallic particle
coated tape.  This definition is provided so these media may be
discussed.


Degausser:  A device that can generate a magnetic field for degaussing
magnetic storage media.  A Type l degausser can purge Type I tapes
and all magnetic disks. A Type Il degausser can purge both Types
IA and Il tapes. There are, at present, no Type III degaussers.
Currently, all Type 1,11, and Ill tapes may be cleared with a
Type l degausser. However, Type Ill tapes with higher than the
current maximum coercivity may be developed that would not be
clearable with a Type I degausser. Refer to the DPL for Type Ill
degausser availability.  Section 3 discusses degaussers further.


Permanent Magnet Degausser:  A hand-held permanent magnet that
has satisfied the requirement to degauss floppy disks, disk platters,
magnetic drum surfaces, bubble memory chips, and thin film memory
modules.  It is not used to degauss magnetic tape.
2.3 OBJECT REUSE AND DATA REMANENCE



The issue of data scavenging on multiuser systems was recognized
to be an area of concern long before the DoD 5200.28-STD, Trusted
Computer System Evaluation Criteria (TCSEC),[20] became the metric
with which to evaluate trusted systems.  The TCSEC reflects this
concern with its requirement that a Trusted Computing Base (TCB)
have a mechanism that enforces an object reuse policy.  This mechanism
must ensure that no user can use the TCB interface to recover
another user's data from recycled storage media (e.g., memory
or disk pages).  Object reuse in trusted computing systems is
comparable (in most respects) to "clearing."


Object reuse can be implemented so that the address space that
contained the object (file) is cleared upon deallocation (the
net result is that unallocated address space is cleared) or upon
allocation (the net result is that unallocated address space may
contain data residue). (Note: There are other ways to implement
object reuse which do not involve clearing.) Information from
a common data storage pool cannot normally be retrieved through
the keyboard.


Some comparisons have been made between trusted systems that satisfy
the object reuse requirement and overwrite programs that do only
clearing or purging; however, it should be noted that overwrite
programs cannot be trusted in the same sense as trusted systems.
 This is primarily because of the environment in which overwrite
programs must operate.


Trusted systems are designed with an object reuse mechanism that
is protected and supported by the TCB, substantiating the degree
of trust placed in the object reuse mechanism. Commercially available
overwrite programs are usually designed to operate on several
different systems and are not evaluated with the same rigor as
trusted systems; however, any overwrite program should be protected
from unauthorized modification. These two security features provide
a similar aspect of data confidentiality but satisfy different
computer security requirements.
3. DEGAUSSERS



DoD 5200.28-M requires that degaussing equipment be tested and
approved by a laboratory of a DoD component or a commercial testing
laboratory where the evaluation tests may be certified.  Test
methods and performance criteria are promulgated in DoD 5200.28-M.
National Security Agency/Central Security Service (NSA/CSS) Specification
L1 4-4-A, Magnetic Tape Degausser, [13] is an updated version
of DoD 5200.28-M degausser testing requirements.  The NSA/CSS
has ensured that degausser testing criteria are current by publishing
NSA/CSS Specification L1 4-4-A.
3.1 A PRIMER



Data are stored in magnetic media by making very small areas called
magnetic domains change their magnetic alignment to be in the
direction of an applied magnetic field.  This phenomena occurs
in much the same way that a compass needle points in the direction
of the earth's magnetic field. Degaussing, commonly called erasure,
leaves the domains in random patterns with no preference to orientation,
thereby rendering previous data unrecoverable.  There are some
domains whose magnetic alignment is not randomized after degaussing.
 The information that these domains represent is commonly called
magnetic remanence.  Proper degaussing will ensure that there
is insufficient magnetic remanence to reconstruct the data.


Erasure via degaussing may be accomplished in two ways: in AC
erasure, the media is degaussed by applying an alternating field
that is reduced in amplitude over time from an initial high value
(i.e., AC powered); in DC erasure, the media is saturated by applying
a unidirectional field (i.e., DC powered or by employing a permanent
magnet).
3.2 DEGAUSSER TESTING



The DoD has adopted the National Security Agency security standard
for degaussing equipment, which requires degaussers to reduce
a special worst-case analog test signal by 90 decibels (db).
More simply stated, degaussing must reduce the test signal to
one billionth (1 part in 109) of its original strength. However,
the signals recorded on magnetic media are easier to erase than
the worst-case test signal. This signal is a test signal that
magnetically saturates a tape and is set forth in references 1
and 13.  After the test signal is recorded on the tape, the tape
is degaussed and the residual signal is evaluated against the
90 db standard.  This quantifies degausser effectiveness.
3.3 LABELING TAPES



It is difficult to distinguish the different types of magnetic
tape from appearance alone.  For this reason, it is recommended
that responsible personnel ensure that type labels (i.e., Type
1,11, or lll) are applied to the tape reels upon initial use.
The label should remain on the reel until the tape is cut from
the reel or the reel is destroyed.


In some cases, adding another label to the tape could introduce
the possibility of operator error in shops where the reel is already
crowded with labels.  Some facilities require the security officer
to use the manufacturer's label to determine tape coercivity.
In any case, strict inventory controls should be in place to ensure
that tapes can be identified by type so the correct purge procedure
is used.
3.4 DEGAUSSER PRODUCTS LIST (DPL)



The list of magnetic degaussers that satisfy the requirements
in NSA/CSS Specification L1 4-4-A is included in the NSA's Information
Systems Security Products and Services Catalogue [10] as the DPL.
 The catalogue is updated quarterly and is available through the
U.S. Government Printing Office.
3.5 DEGAUSSING EQUIPMENT FAILURE



Because of the possibility of equipment failure, degaussing equipment
should be periodically tested to verify correct operation throughout
the life cycle of the equipment.  Preventive maintenance should
be done on a regular schedule to preclude mechanical or electrical
problems.   Some manufacturers have maintenance contracts and
recommended maintenance schedules to ensure the integrity of the
degaussing procedure.


To provide a rough estimate of degausser effectiveness, an on-site
test of generated magnetic field strength may be done by using
a gaussmeter for some models of Type l degaussers. (Some Type
l degaussers cannot be tested in this manner because the degaussing
field is not accessible.)  However, a more extensive test is required
to maintain an adequate degree of assurance that the degausser
is operating correctly. Both Type l and ll degaussers may be periodically
tested more extensively by testing against the 90 db test signal
strength reduction requirement in NSA/CSS Specification L1 4-4-A
using the following procedure: have the tape prerecorded with
the specified test signal (in a testing laboratory), degauss the
tape, then return the tape to the laboratory where it can be tested
for the remanent signal level. [13] Check with local authorities
or engineering personnel to determine if such a service is available
to your organization. There are two companies listed in the DPL,
Integra Technologies Corporation and Data Security, Incorporated,
that can test an installed degausser's effectiveness.


Although this periodic test is not a DoD requirement, it is highly
recommended.


After a degausser is installed, it should be tested periodically
(approximately every six months) for its first two years of operation.
This data can be used to develop a histogram of the degausser's
operation.  Based on this information, an informed decision can
be made about extending the interval between testing, e.g., every
9 months, yearly, every 18 months, etc.


Note that it is erroneous to assume that even a newly installed
degausser, let alone a degausser several years old, is providing
sufficient erasure.  It is not prudent to rely upon one DoD evaluation
of the degausser manufacturer's product line because of possible
product failure.
4. RISK CONSIDERATIONS



Many risks should be considered when reuse or release of AIS storage
media is anticipated.  AIS security personnel, operations personnel,
users, and other designated responsible persons should be aware
of these risks before attempting to declassify or make any decision
to release storage media.
4.1 DESTINATION OF RELEASED MEDIA



The risk of compromise of sensitive data increases when AlS storage
media is released for any reason outside of the controlled environment.
 Personnel should consider the media's destination when evaluating
this risk.
4.2 EFFECTS OF HEAT AND AGE



Version 1 of this document reported that magnetic media stored
for either an extended period of time or under high temperature
conditions (120 degrees Fahrenheit or greater) becomes more difficult
to degauss or erase.  Additional research is in progress to validate
the effects of heat and age on the erasure process. [14]
4.3 MECHANICAL STORAGE DEVICE EQUIPMENT FAILURE



Some of the early disk drives required manual alignment of read/write
heads.  The effectiveness of an overwrite on this technology base
may be reduced because of equipment failure or mechanical faults,
such as misalignment of read/write heads.  Hardware preventive
maintenance procedures should be done on schedule, and records
should be maintained in an effort to prevent this problem.
4.4 STORAGE DEVICE SEGMENTS NOT RECEPTIVE TO OVERWRITE



A compromise of sensitive data may occur if media is released
when an addressable segment of a storage device (such as unusable
or "bad" tracks in a disk drive or inter-record gaps
in tapes) is not receptive to an overwrite.  As an example, a
disk platter may develop unusable tracks or sectors; however,
sensitive data may have been previously recorded in these areas.
 It may be difficult to overwrite these unusable tracks. Before
sensitive information is written to a disk, all unusable tracks,
sectors, or blocks should be identified (mapped).  During the
life cycle of a disk, additional unusable areas may be identified.
If this occurs and these tracks cannot be overwritten, then sensitive
information may remain on these tracks.  In this case, overwriting
is not an acceptable purging method and the media should be degaussed
or destroyed.
4.5 OVERWRITE SOFTWARE AND CLEARING



 Overwriting is an effective method of clearing data.  In an operational
system, an overwrite of unassigned system storage space can usually
accomplish this, provided the system can be trusted to provide
separation of system resources and unauthorized users. For example,
a single overwrite of a file (or all system storage, if the circumstance
warrants such an action) is adequate to ensure that previous information
cannot be reconstructed through a keyboard attack.  Note: Simply
removing pointers to the file will not generally render the previous
information unrecoverable.  Software used for clearing should
be under strict configuration controls.  See A Guide to Understanding
Configuration Management in Trusted Systems for additional information
on this subject. [7]
4.6 OVERWRITE SOFTWARE AND PURGING



 The DoD has approved overwriting and degaussing for purging data,
although the effectiveness of overwriting cannot be guaranteed
without examining each application.  If overwriting is to be used
in a specific application, software developers must design the
software such that the software continues to write to all addressable
locations on the media, in spite of intermediate errors. All such
errors in usable sectors should be reported with a listing of
current content.  In addition, unusable sectors must be completely
overwritten, because the unusable sector list will not show whether
the sector ever contained any sensitive data.  If any errors occur
while overwriting or if any unusable sector could not be overwritten,
then degaussing is required.


There are additional risks to trusting overwrite software to purge
disks.  The environment in which the software must operate is
difficult to constrain.  For this reason, care must be exercised
during software development to ensure the software cannot be subverted.
The overwrite software should be protected at the level of the
media it purges, and strict configuration controls should be in
place on both the operating system the software must run under
and the software itself. The overwrite software must be protected
from unauthorized modification. [7]
4.7 CONTRACTUAL OBLIGATION



Leased equipment containing nonremovable magnetic storage media
should not be returned to the vendor unless the media is declassified
using an approved procedure.  Problems may be encountered obtaining
warranty repair service or returning the equipment at termination
of lease.  Contractual maintenance agreements should address the
issue of degaussed media and its effect on equipment warranties.
4.8 MAINTENANCE



Proper purging is especially important in relation to maintenance,
whether routine or not. Purge procedures should be conducted and
the device declassified before uncleared personnel undertake maintenance
actions.   If purging is impractical, prohibitively expensive,
or could destroy the device, then precautions should be taken
to reduce the threat to sensitive information on the device.
Maintenance actions should be observed by an individual who has
been provided with guidance so that improper actions can be discerned
and unauthorized disclosure can be prevented.


If test and diagnostic equipment (T & DE) is used on an AIS
that has not been purged, there is a possibility that the T &
DE can capture sensitive information. To prevent unauthorized
disclosure, the T & DE should either be purged after use or
remain safeguarded at the highest level of information resident
on the AIS.


For example, if a sensitive disk drive is serviced, the escort
official should know that the maintenance person is not allowed
to remove the damaged disk from the facility.  The escort also
should be capable of identifying when a maintenance person has
altered the protective characteristics of the device.
4.9 DATA SENSITIVITY



AlS storage media may have contained information so sensitive
that authorities decided to never allow declassification of the
AlS or its storage media. Examples of such sensitive information
are communications security (COMSEC) information marked CRYPTO
or Single Integrated Operational Plan (SlOP) information. In these
cases, the holder of the media should not attempt to declassify
or release the media except as directed by proper organizational
approving authorities. [9]  Destruction may be the only alternative
to indefinite storage of such highly sensitive media.
4.10 DEGAUSSING



Although degaussing is the best method for purging most magnetic
storage media, it is not without risk. Degaussers can be used
improperly. For example, the media may be removed before the degaussing
cycle is complete. Also, degaussers can fail or have a reduced
capability over time.  Good degausser design can alleviate much,
but not all, of this risk. This risk can be mitigated by periodic
testing (see Section 3.5, "Degaussing Equipment Failure").


Mistakenly using a Type l degausser to purge Type ll tape is another
risk. Type I degaussers cannot purge Type ll tape. Magnetic tape
should have a label applied to the reel that identifies the coercivity
of the media, because coercivity cannot always be distinguished
by physical appearance. Strict inventory controls should be in
place to ensure tapes can be identified by type so the correct
purge procedure is used. If type labels are used, they should
not be removed from the reel unless the tape is cut from the reel
or the reel itself is destroyed.  Labels that show classification
should not be removed from the reel until the media is declassified.
 See Section 3.3, "Labeling Tapes," for more information
about labels.
5. STANDARDS

5.1 GENERIC PROCEDURES



There are two primary procedures allowed by DoD policy for clearing
and purging AIS memory and secondary storage media that have processed
sensitive information: overwriting and degaussing. [1] Other procedures
are media specific and this section details them where appropriate.
 The need for destruction arises when the media reaches the end
of its useful life.
5.1.1 OVERWRITING



Overwriting is a process whereby unclassified data are written
to storage locations that previously held sensitive data.  To
satisfy the DoD clearing requirement, it is sufficient to write
any character to all data locations in question.  To purge the
AIS storage media, the DoD requires overwriting with a pattern,
then its complement, and finally with another pattern; e.g., overwrite
first with 0011 0101, followed by 11001010, then 1001 0111. The
number of times an overwrite must be accomplished depends on the
storage media, sometimes on its sensitivity, and sometimes on
differing DoD component requirements. In any case, a purge is
not complete until a final overwrite is made using unclassified
data.
5.1.2 DEGAUSSING



Degaussing is a process whereby the magnetic media is erased,
i.e., returned to its initial virgin state. To satisfy the DoD
requirement on degaussing a classified magnetic tape, the degausser
must have met DoD testing requirements as discussed in Section
3, "Degaussers."
5.1.3 DESTRUCTION



It is good practice to purge media before submitting it for destruction.
 Media may generally be destroyed by one of the following methods.
(Although approved methods, options d and e use acid, which is
dangerous and excessive, to remove recording surfaces. Options
a, b, and c are recommended over d and e.)

 • a. Destruction at an approved metal destruction facility,
i.e., smelting, disintegration, or pulverization.
 • b. Incineration.
 • c. Application of an abrasive substance (emery wheel or disk
sander) to a magnetic disk or drum recording surface. Make certain
that the entire recording surface is completely removed before
disposal.  Also, ensure proper protection from inhaling the abraded
dust.
 • d. Application of concentrated hydriodic acid (55% to 58%
solution) to a gamma ferric oxide disk surface.  Acid solutions
should be used in a well-ventilated area only by qualified personnel.
 • e. Application of acid activator Dubais Race A (8010 181 7171)
and stripper Dubais Race B (8010 181 7170) to a magnetic drum
recording surface.  Technical acetone (6810 184 4796) should then
be applied to remove residue from the drum surface. The above
should be done in a well-ventilated area, and personnel must wear
eye protection.  Extreme caution must be observed when handling
acid solutions.  This procedure should be done only by qualified
and approved personnel.







For additional information on destruction techniques and emergency
destruction, see Institute for Defense Analyses (IDA) Report R-321,
Emergency Destruction of Information Storing Media. [6]
5.2 SPECIFIC PROCEDURES



DoD 5200.28-M provides accepted DoD procedures to clear, purge,
declassify, and destroy storage media.  This section, "Standards,"
is a reflection of those procedures but does not provide the entire
procedure (e.g., use three overwrites to purge disks). This is
because these standards are evolving and this document, A Guide
to Understanding Data Remanence in Automated Information Systems,
is not to be construed as replacing policy.
5.2.1 MAGNETIC TAPES



Although overwriting can be used for clearing this media, the
method is time consuming and generally never used. Also, inter-record
gaps may preclude proper clearing. A better method for clearing
Type 1,11, and Ill tapes is degaussing with a Type l or Type II
degausser. This procedure is considered acceptable for clearing,
but not purging, all types of tapes.


Degaussing with an appropriate degausser is the only method the
DoD accepts for purging this media.  Specifically, a Type I degausser
can purge only Type tapes, and Type II degaussers can purge Types
l and Il tapes.  No degausser presently exists that is capable
of purging Type III tapes in accordance with NSA/CSS Specification
L1 4-4-A.
5.2.2 MAGNETIC HARD DISKS



The DoD has approved both overwriting and degaussing as methods
to clear or purge this media.  See Section 4, "Risk Considerations,"
and DoD 5200.28-M for additional information. Degaussed disks
will generally require restoration of factory installed timing
tracks.  Type I degaussers and approved hand-held magnets can
purge this media up to a coercivity level of 1100 oersteds. If
hand-held magnets are used, then the magnet must be placed in
almost direct contact with the disk, separated by only a tissue
to prevent scratching the disk. Sometimes it is possible to insert
the magnet between the platters without disassembling them.  As
a practical matter, if the drive must be disassembled, it is usually
easier to destroy the platters than to degauss and then reinstall
them.


Recently completed research has indicated that degaussing is an
effective method to purge rigid disk media. Large cavity degaussing
equipment can be used to erase the data from sealed disk packs
and Winchester style hard disk drives while the platters remain
in the drive. Care must be exercised to ensure that the disk drive
is not encasqd in a material that conducts a magnetic field. Research
has shown that aluminum housings on Winchester disk drives attenuate
the degaussing field by only about 2 db. Operational guidance
is now being developed for the DoD.
5.2.3 MAGNETIC DRUMS



The DoD has approved both overwriting and degaussing as methods
to clear or purge this media.  See Section 4, "Risk Considerations,"
and DoD 5200.28-M for additional information.  Type l degaussers
and approved hand-held magnets can purge this media, with the
latter being the only practical alternative.
5.2.4 MAGNETIC FLOPPY DISKS AND CARDS



The DoD has approved overwriting for clearing, but not purging,
magnetic floppy disks. Degaussing is the preferred method. The
technology of magnetic cards is old and not generally used. Degaussing
with Type I degaussers or approved hand-held magnets is the only
DoD accepted method of purging floppy disks and cards, regardless
of their coercivity. See DoD 5200.28-M for additional information.
5.2.5 MAGNETIC CORE MEMORY



The DoD has approved both overwriting and degaussing as methods
to clear or purge magnetic core memory.  Type l degaussers and
hand-held magnets can purge this media. See DoD 5200.28-M for
additional information.
5.2.6 PLATED WIRE MEMORY



There are restrictions on overwriting magnetic plated wire memory
based on the amount of time that information was resident in the
same memory location.  See DoD 5200.28-M for additional information.
5.2.7 THIN FILM MEMORY



The DoD has approved both overwriting and degaussing as methods
to clear or purge thin film memory. Type l degaussers and approved
hand-held magnets can purge this media.
5.2.8 MAGNETIC BUBBLE MEMORY



The DoD has approved both overwriting and degaussing as methods
to clear or purge magnetic bubble memory.  An alternative procedure
for magnetic bubble memory modules that have been designed with
a built-in bias voltage control is to adjust (i.e., raise) the
bias voltage to a level that would cause ttr;e collapse of all
the magnetic bubbles. On some bubble devices a chip erase is invoked
by pulsing the z-coil. If the memory was designed with a bias
control, information will be available from the vendor on the
correct bias voltage level to apply to cause the collapse of all
the magnetic bubbles. Type l degaussers and approved hand-held
magnets can purge this media.  Degaussed bubble memory will generally
require reinitialization with programs available from the manufacturer.
 Bubble memory has not been shown to exhibit any magnetic remanence
after application of any of these purging methods.
5.2.9 RANDOM ACCESS MEMORY (RAM)



The DoD has approved both overwriting and removal of power as
methods to clear or purge RAM. See DoD 5200.28-M for additional
information.
5.2.10 READ ONLY MEMORY (ROM)



Because data is permanently stored in ROM, clearing and purging
this media has no relevance. See DoD 5200.28-M for additional
information.
5.2.11 ERASABLE PROGRAMMABLE READ ONLY MEMORY (UVPROM)



The DoD has approved the use of ultraviolet light to clear or
purge UVPROM.


See DoD 5200.28-M for additional information.
5.2.12 ELECTRICALLY ERASABLE READ ONLY MEMORY (EEPROM)



The DoD has approved different forms of overwriting (e.g., single-step
chip erase, individual overwriting, etc.) as methods to clear
or purge EEPROM. See DoD 5200.28-M for additional information.
6. OTHER STORAGE AND OVERWRITE TECHNOLOGY

6.1 OPTICAL DISKS



The following are examples of optical disks:  CD-ROM (ReadOnly),
WORM (WriteOnce~ReadMany), and magneto-optical (ReadManyWriteMany).
 Currently, no procedures exist that are considered adequate to
ensure purging of these media.  Magneto-optical disk technology
uses a combination of laser optics and magnetics to obtain data
densities far surpassing those of magnetic disks alone.  Magneto-optical
disks can be cleared by a single overwrite, although purging by
overwrite is not considered adequate.
6.2 FERROMAGNETIC RAM



This technology couples magnetics with semiconductor random access
memory to provide data retention after power is removed.  There
have been no standards published providing procedures to ensure
clearing or purging of these media.  However, consistency with
all other types of storage media would dictate that a single overwrite
is sufficient for clearing.
6.3 DISK EXERCISERS



As noted earlier in Section 4.6, "Overwrite Software and
Purging," many drawbacks exist to using overwrite software
for purging disks.  Some of these drawbacks are not applicable
to disk exercisers, which use a dedicated operating system.  Winchester
disk manufacturers use disk exercisers to do as their name implies-put
Winchester disk drives through their paces.  To purge a Winchester
drive, the Winchester unit must be plugged into the disk exerciser.
 The disk exerciser is able to write to any part of a disk regardless
of whether the operating system labeled the sector unusable.
Some of these "exercisers" also have the capability
of writing at different frequencies.  This makes them a more effective
alternative to overwrite software; however, their ability to purge
disks has not been tested.
7. FUTURE DIRECTIONS



Several areas in data remanence can benefit from more investigation.
After the adequacy of overwrites to ensure purging is determined,
the use of disk exercisers for the purging of magnetic disks should
be researched. Because of the increasing use of magneto-optical
disks, research should be initiated on methods to purge this media
also.


A good primer on magnetic coatings used for disks and tapes is
Particulate Magnetic Recording: A Review, by Michael P. Sharrock.
[18]  For a discourse on future storage trends, see Data Storage
in 2000-Trends in Data Storage Technologies, by Mark H. Kryder.
[12]  The IEEE Transactions on Magnetics provides a wealth of
information on the field of magnetics1 with entire sections devoted
to engineering-level discussions related to magnetic remanence
in AIS storage media.


Announcements concerning cavity degaussers should be forthcoming.
See the Degausser Products List for these announcements and for
announcements about decisions concerning magnetic media degaussing.


DoD policy, procedures, and guidance need continual refinement
to keep pace with the evolving storage technologies. Although
there is no focal point responsible for ensuring erasure standards
are current, various agencies have sponsored research that has
ensured our erasure standards provide an adequate degree of security.
 This has caused duplication of effort at times, but it has also
provided additional validation of earlier work. However, a focal
point would ensure research is duplicated only when necessary.
As storage technology advances and clear and purge procedures
are developed and refined, this guideline will be periodically
updated to reflect the changes. DoD 5200.28-M should be updated
also.
GLOSSARY



Automated Information System.  An assembly of computer hardware,
firmware, and/or software configured to collect, create, communicate,
compute, disseminate, process, store, and/or control data or information.


AlS Storage Media. The physical substance(s) used by an AS system
upon which data are recorded.


Clearing AIS Storage Media. Removal of sensitive data from an
AS at the end of a period of processing, including from AlS storage
devices and other peripheral devices with storage capacity, in
such a way that there is assurance, proportional to the sensitivity
of the data, that the data may not be reconstructed using normal
system capabilities, i.e., through the keyboard. An AlS need not
be disconnected from any external network before a clear.


Coercive Force.  A negative or reverse magnetic force applied
for reducing magnetic induction to zero.


Coerciviry. The amount of applied magnetic field (of opposite
polarity) required to reduce magnetic induction to zero. It is
often used to represent the ease with which magnetic media can
be degaussed.


Configuration Control.  The process of controlling modifications
to the system's hardware, firmware, software, and documentation
that provide sufficient assurance that the system is protected
against the introduction of improper modifications before, during,
and after system implementation.   Compare "configuration
management."


Configuration Management.   The management of security features
and assurances through control of changes made to a system's hardware,
software, firmware, documentation, test, test fixtures and test
documentation throughout the development and operational life
of the system. Compare "configuration control."


Data. A representation of facts, concepts, information, or instructions
suitable for communication, interpretation, or processing by humans
or by an AIS.


Declassification of AlS Storage Media.  A procedure and an administrative
decision to remove the security classification of the subject
media.


Degausser. A device that can generate a magnetic field for degaussing
magnetic storage media.


Degausslng.  To reduce magnetic induction to zero by applying
a reverse magnetizing field. Also called "demagnetizing."


Degausser Products List (DPL). A list of commercially produced
degaussers that meet National Security Agency specifications as
set forth in reference 13.  The National Security Agency includes
this list in their Information Systems Security Products and Services
Catalogue.


Designated Approving Authority (DAA).  The official who has the
authority to decide to accept the security safeguards prescribed
for an AlS or the official who may be responsible for issuing
an accreditation statement that records the decision to accept
those safeguards. The DAA must be at an organizational level such
that he or she has the authority to evaluate the overall mission
requirements of the AlS and provide definitive directions to AlS
developers or owners relative to the risk in the security posture
of the AIS.


Downgrade.  A procedure and an administrative decision to reduce
the security classification of the subject media.


Erasure. A process by which data recorded on storage media is
removed.


Gauss.  A unit mea,sure of the magnetic flux density produced
by a magnetizing force.


InformatIon System Security Officer (1550). The person responsible
to the DAA for ensuring that security is provided for and implemented
throoghout the life cycle of an AS from the beginning of the system
concept development phase through its design, development, operation,
maintenance, and secure disposal.


Information Systems Security Products and Services Catalogue (INFOSEC
Catalog).  A catalog issued quarterly by the National Security
Agency to assist in the selection of products and services that
will provide an appropriate level of information security.  The
National Security Agency issues the DPL in this publication, which
is available through the Government Printing Office. Inter-Record
Gap. The "area" between data records on a magnetic tape.
Keyboard Attack. Data scavenging through resources available to
normal system users, which may include advanced software diagnostic
tools.


Laboratory Attack. Data scavenging through the aid of what could
be precise or elaborate equipment.


Magnetic Field Intensity.  The magnetic force required to produce
a desired magnetic flux, given as the symbol H (see definition
of "oersted").


Magnetic Flux. Lines of force representing a magnetic field.


Magnetic Flux Density.  The representation of the strength of
a magnetic field, given as the symbol B (see definition of "gauss").


Magnetic Remanence. The magnetic flux density that remains in
a magnetic circuit after the removal of an applied magnetic field.
For discussion purposes, it is better to characterize magnetic
remanence as the magnetic representation of residual information
that remains on magnetic media after the media has been erased.


Magnetic Saturation. The condition in which an increase in magnetizing
force will produce little or no increase in magnetization.


Object Reuse. The reassignment to some subject of a medium (e.g.,
page frame, disk sector, or magnetic tape) that contained one
or more objects. To be securely reassigned, no residual data from
the previously contained object(s) can be available to the new
subject through standard system mechanisms.


Oersted. A unit of magnetic field strength.


Overwrite Procedure. A procedure to destroy data recorded on AIS
storage media by recording patterns of unclassified data over
the data stored on the media.


Permanent Magnet Degausser.  Hand-held permanent magnet that generates
a magnetic field for degaussing magnetic storage media.


Purge.  The removal of sensitive data from an AIS at the end of
a period of processing, including from AIS storage devices and.
other peripheral devices with storage capacity, in such a way
that there is assurance proportional to the sensitivity of the
data that the data may not be reconstructed through open-ended
laboratory techniques.  An AIS must be disconnected from any external
network before a purge.


Remanence. The residual information that remains on storage media
after erasure.


Scavenging.  Searching through object residue (file storage space)
to acquire unauthorized data.


Trusted Computer System Evaluation Criteria (TCSEC). A document
published by the National Computer Security Center containing
a uniform set of basic requirements and evaluation classes for
assessing degrees of assurance in the effectiveness of hardware
and software security controls built into systems. These criteria
are intended for use in the design and evaluation of systems that
will process and/or store sensitive or classified data. This document
is DoD 5200.28-STD and is often called The Criteria or The Orange
Book.


Trusted Computing Base (TCB).  The totality of protection mechanisms
within a computer system, including hardware, firmware, and software,
the combination of which is responsible for enforcing a security
policy. A TCB consists of one or more components that together
enforce a unified security policy over a product or system.  The
ability of a TCB to correctly enforce a security policy depends
solely on the mechanisms within the TCB and on the correct input
by system administrative personnel of parameters (e.g., a user's
clearance) related to the security policy.


Trusted Computing System.  A system that employs sufficient hardware
and software integrity measures to allow its use for simultaneously
processing a range of sensitive or classified information.


Type l Tape. Magnetic tape whose coercivity does not exceed 350
oersteds (also known as low-energy tape).


Type II Tape. Magnetic tape whose coercivity ranges from 351 oersteds
up to 750 oersteds (also known as high-energy tape).


Type III Tape. Magnetic tape whose coercivity exceeds 750 oersteds.
REFERENCES


 • 1. Automated Data Processing Security Manual, Department of
Defense Manual, DoD 5200.28-M, January 1973 with change pages
in June 1979 (now under revision).
 • 2. Care and Handling of Computer Magnetic Storage Media, Department
of Commerce, National Bureau of Standards Special Publication
500-101, June 1983.
 • 3. Computer Security Evaluation Center, Department of Defense
Directive, DoDD 5215.1,25 October 1982.
 • 4. Department of the Navy Automated Data Processing Security
Program, Chief of Naval Operations Instruction, OPNAVlNST 5239.1A
with change 1, 3 August 1982.
 • 5. Department of the Navy Automated Information System Security
Program, Secretary of the Navy Instruction, SECNAVINST 5239.2,
1 November 1989.
 • 6. "Emergency Destruction of Information Storing Media,"
Institute for Defense Analyses Report, R-321, December 1987.
 • 7. A Guide to Understanding Configuration Management in Trusted
Systems, National Computer Security Center Technical Guideline,
NCSC-TG-006, Version 1,28 March 1988.
 • 8. Industrial Security Manual for Safeguarding Classified
Information, Department of Defense Manual, DoD 5220.22-M, June
1987.
 • 9. Information Systems Security, Army Regulation, AR 380-19,
4 September 1990.
 • 10. Information Systems Security Products and Services Catalogue,
National Security Agency, quarterly publication.
 • 11. Katti, Romney R., "Erasure in Magnetic Recording
Media," doctoral dissertation, Carnegie-Mellon University,
12 April 1988.
 • 12. Kryder, Mark H., "Data Storage in 2000-Trends in
Data Storage Technologies," IEEE Transactions on Magnetics,
VoI. 25, No. 6, November 1989.
 • 13. Magnetic Tape Degausser, National Security Agency/Central
Security Service (NSA/CSS) Specification L1 4-4-A, 31 October
1985.
 • 14. Mountfield, K. R., and M. H. Kryder, "The Effect
of Erasure in Particulate Disk Media," IEEE Transactions
On Magnetics, Vol. 25, No. 5, September 1989.
 • 15. National Policy on Telecommunications and Automated Information
Systems Security, National Security Decision Directive, NSDD 145,
17 September 1984.
 • 16. Remanence Security, Air Force Systems Security Instruction,
AFSSI 5020,15 April 1991.
 • 17. Security Requirements for Automated Information Systems,
Department of Defense Directive, DoDD 5200.28, March 1988.
 • 18. Sharrock, Michael P., "Particulate Magnetic Recording:
A Review," lEEE Transactions on Magnetics, Vol. 25, No. 6,
November 1989.
 • 19. "Signal Processing Applications Techniques to Magnetic
Erasrnre Data," Illinois Institute of Technology, Research
Institute, Final Reports for Projects E06522, K06005, and K06051,
February 1982, September 1982, and March 1984 respectively.
 • 20. Trusted Computer System Evaluation Criteria, Department
of Defense Standard, DoD 5200.28-STD, December 1985.
 • 21. Veeravalli, Venugopal V., "Detection of Digital Information
From Erased Magnetic Disks," masters thesis, Carnegie-Mellon
University, 1987.
 • 22. Wiesen, Kurt, "Modeling of Magnetic Media,"
masters thesis, Carnegie-~eIlon University, July 1986.





T